CVE-1999-1085

The CVE-1999-1085 issue affects SSH1 protocol implementations (notably OpenSSH and SSH1-supporting SSH stacks) in CBC or CFB mode. A CRC-32 checksum weakness enables a known-plaintext attack to insert arbitrary data into an existing SSH stream between client and server, potentially allowing an at...

multiple vulnerabilities in bind 8.x

Multiple vulnerabilities exist in the versions of BIND found in Slackware 7.1 and -current. Users of BIND 8.x are urged to upgrade to 8.2.3 to fix these problems. More information can be found on the BIND website: http://www.isc.org/products/BIND/ ... and in the CERT Advisory CA-2001-02 - Multipl...

[TL-Security-Announce] fetchmail-5.5.0-3.i386.rpm TLSA2000024-1

TurboLinux Security Announcement Package: fetchmail-5.5.0-2 and earlier Date: Wednesday December 27 5:00 PDT 2000 Affected TurboLinux versions:TL 6.1 WorkStation, All TurboLinux versions 6.0.5 and earlier TurboLinux Advisory ID: TLSA2000024-1 Credits: This bug was reported by Red Hat on November...

[SECURITY] New version of ghostscript released

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman November 23, 2000 - ------------------------------------------------------------------------ Package : gs Problem type : symlink...

CVE-1999-0600

A CVE-1999-0600 entry concerns a network intrusion detection system (IDS) that does not verify the checksum on a packet. The connected Red Hat, CVE, NVD, and CVE List records reiterate the same description, but do not specify affected products, versions, or a concrete root cause beyond missing ch...

CVE-1999-0600

A network intrusion detection system IDS does not verify the checksum on a packet...

[SECURITY] New versions of man2html fixes postinst glitch

Former versions of man2html uses a static file in /tmp for writing. This can lead into overwriting system files if a malicious user has created a symbolic link to it before upgrading man2html. We recommend you upgrade your man2html package as soon as possible. wget url will fetch the file for you...

[SECURITY] Corrected advisory on wu-ftpd-academ buffer overflow

The previous advisory concerning wu-ftpd-academ contained an error: the md5sum given for wu-ftpd-academ2.4.2.16-12.2i386.deb was incorrect. The correct md5sum is b851adb345917a6f92e8b03f8cc97ff2. I apologize for the confusion this has caused. The complete, updated, text of the advisory follows...

CVE-1999-0600

A network intrusion detection system IDS does not verify the checksum on a packet...

CVE-1999-0663

A system-critical program, library, or file has a checksum or other integrity measurement that indicates that it has been modified...

PT-1999-1218 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A network intrusion detection system IDS fails to verify the checksum on a packet. This issue may allow unauthorized access or malicious activity to go undetected. Recommendations: ...

[SECURITY] New version of zgv fixes buffer overflows

We have received reports that the zgv package is vulnerable to buffer overflows. We recommend you upgrade your zgv package immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.0 alias hamm ------------------------------- This...

[SECURITY] New versions of bash fixes buffer overflows

We have received reports that the bash shell had a problem with very long pathnames. When a very long path was encountered bash failed to check the result of getcwd in all places, which could be exploited. We recommend you upgrade your bash package immediately. wget url will fetch the file for yo...

[SECURITY] New versions of apache fixes denial of services

We have received a report from Dag-Erling Coidan Smørgrav who says that the apache as distributed with Debian GNU/Linux 2.0 is vulnerable to a denial of services exploit, where repeated, identical headers can consume On^2 memory. We recommend you upgrade your apache package immediately. wget url...

[SECURITY] New versions of cfingerd fixes root compromise

We have received a report that a user can execute arbitrary commands from a .plan or .project file. While the option that would allow this is disabled by default the system is vulnerable if the system admin had this option enabled. We recommend you upgrade your cfingerd package immediately. dpkg ...

CVE-1999-1085

SSH 1.2.25, 1.2.23, and other versions, when used in in CBC Cipher Block Chaining or CFB Cipher Feedback 64 bits modes, allows remote attackers to insert arbitrary data into an existing stream between an SSH client and server by using a known plaintext attack and computing a valid CRC-32 checksum...

[SECURITY] Current versions of mailx fixes /tmp problem

Former versions of mailx used an unsecure means of opening files beneath /tmp for writing. This can be used to damage files in a users directory or even systemwide. We recommend you upgrade your mailx package immediately. dpkg -i file.deb will install the referenced file. Debian GNU/Linux 1.3.1...

[SECURITY] Security fixed versions of sparc binaries available

==================================================================== Debian GNU/Linux Security May 17, 1998 We have received reports that former versions of procps, shadow, fakeroot, gzip, perl and bind in hamm were vulnerable to some exploits. Please refer to the following web pages to get more...